Connect a custom domain

Once you're on the Pro plan or higher, you can point any domain you own at a Linkfor site. The flow is one DNS record per domain; certificates and renewals are automatic.

This page covers the two common shapes:

• Subdomain like docs.acme.com — easiest, one CNAME record.
• Apex (also called root or naked) like acme.com — needs an A record because DNS doesn't allow CNAMEs at the apex.

1. Add the mount in the dashboard

Open the site's Mounts tab, click Add a mount, and enter the hostname you want — docs.acme.com or acme.com. Leave the mount path at / for a top-level site.

When you submit, the mount enters the pending status and the dashboard shows the DNS record you need to add at your registrar. We auto-detect changes and flip the row to active once the record lands and TLS is issued — usually 1-5 minutes after you save it.

2a. Subdomain — set a CNAME

Add a single record at your DNS provider:

Type    Name              Value                  TTL
CNAME   docs              cname.linkfor.xyz      300

Name is just the subdomain part (docs), not the full hostname. TTL of 300 seconds (5 minutes) is fine — it's a one-time setup.

If you use Cloudflare, set the record to DNS only (the grey cloud, not the orange one). Proxied records strip the host header we use to route the request, and the mount won't activate.

2b. Apex — set an A record

Apex domains can't have CNAMEs (a long-standing DNS quirk). Use an A record instead:

Type    Name        Value             TTL
A       @           76.76.21.21       300

Name is @ (or blank, depending on your registrar's UI) — that's the apex itself. The IP 76.76.21.21 is Vercel's anycast edge, where we issue and serve every Linkfor TLS certificate.

If your registrar supports ALIAS or ANAME records (Cloudflare, DNSimple, easyDNS), you can use one of those pointing at cname.linkfor.xyz instead — same effect, just CNAME-flattened by your provider.

3. Wait for the green check

The dashboard polls DNS every five seconds. When the record resolves and our edge issues a TLS certificate, the mount status flips to active. Test by visiting https://<your-domain>.

If it stays pending longer than ten minutes:

• DNS propagation — some providers cache stale records. dig docs.acme.com or nslookup docs.acme.com should return the value above.
• Cloudflare proxy — if the row says misconfigured, double-check the orange-cloud / grey-cloud setting.
• HSTS preload — if the apex is on the HSTS preload list and TLS isn't issued yet, browsers refuse the connection. Wait the full ten minutes for our edge to finish issuance, or test from curl.

TLS and renewals

Certificates are issued via Vercel's edge (Let's Encrypt under the hood) the first time DNS resolves cleanly. They renew automatically; there's nothing to configure or pay for.

If you ever migrate the domain off Linkfor, remove the mount in the dashboard before changing DNS — that releases the certificate slot and the SSL row at our edge.

Troubleshooting

Status stuck on pending — DNS hasn't propagated. Check at https://www.whatsmydns.net/#A/<domain> (apex) or #CNAME/<domain> (subdomain) — when most resolvers show our value, refresh.

Status flips to misconfigured — DNS resolved but to the wrong target. Re-check the record exactly matches the value in the dashboard. Cloudflare proxy is the usual culprit.

SSL_ERROR_NO_CYPHER_OVERLAP in the browser — the cert hasn't been issued yet. Wait a minute and reload.